CVE-2026-81092: mcp-go before 0.56.0 Missing Host Header Validation Enables DNS Rebinding
mcp-go accepted requests on its HTTP transports without checking the Host header. StreamableHTTPServer.ServeHTTP in server/streamablehttp.go and SSEServer.ServeHTTP in server/sse.go served any request arriving over a loopback connection regardless of the host it named, and the SSE transport's cross-origin default allowed any origin. A page in a browser could therefore point a name it controlled at the loopback address and reach a server listening there, invoking tools and reading resources that the server exposed on the assumption that only local software could connect. No release before 0.56.0 validated the header on either transport; 0.56.0 adds server/httplocalhost.go, which rejects a loopback-bound request carrying a host that is not a loopback name, and wires it into both transports.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
mcp-goto a version that resolves this vulnerability.Fixed in 0.56.0 - Configuration
Update to v0.56.0 so that server/http_localhost.go rejects requests bound to loopback when the request Host is not a loopback name, and wires this validation into both transports.
mcp-go HTTP transports (server/http_localhost.go) loopback Host validation = enabled - Configuration
Update to v0.56.0 so that the SSE transport no longer uses the previous cross-origin default that allowed any origin.
mcp-go SSE transport cross-origin default = restricted
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments using mcp-go HTTP transports that listen on a loopback address are exposed if they run a release before 0.56.0. Both StreamableHTTPServer and SSEServer accepted loopback requests without validating that the Host header named a loopback host.
What does an attacker need to exploit this?
An attacker needs to induce a user to visit a web page in a browser. The page can use a hostname controlled by the attacker that resolves to the loopback address, allowing it to reach the local server through DNS rebinding.
What could an attacker access?
An attacker could invoke tools and read resources exposed by the local mcp-go server. The impact depends on what that server makes available under the assumption that only local software can connect.
Does the issue affect the SSE transport's cross-origin behavior?
Yes. The SSE transport allowed any origin by default, and it also lacked Host header validation before 0.56.0.
What change addresses the issue?
Upgrade to mcp-go 0.56.0 or later. Version 0.56.0 adds loopback Host header validation and applies it to both the Streamable HTTP and SSE transports.